[CentOS] Samba's winbind and SELinux conflict

Thu Jan 10 22:02:00 UTC 2008
Filipe Brandenburger <filbranden at gmail.com>

Hi,

I was trying to setup winbind on a CentOS 4 host to authenticate to the AD
on my network. My smb.conf is very simple, I'm only setting workgroup,
realm, security, and I'm setting for winbind:

   encrypt passwords = yes
   winbind separator = +
   idmap uid = 10000-20000
   idmap gid = 10000-20000

When trying to start the service with "service winbind start", I'm getting
these error messages:

Jan 10 16:18:00 myhost kernel: audit(1199999880.483:2): avc:  denied  {
write } for  pid=4490 comm="winbindd" name="secrets.tdb" dev=sda2 ino=192690
scontext=root:system_r:winbind_t tcontext=root:object_r:samba_etc_t
tclass=file
Jan 10 16:18:00 myhost winbindd[4490]: [2008/01/10 16:18:00, 0]
passdb/secrets.c:secrets_init(67)
Jan 10 16:18:00 myhost winbindd[4490]:   Failed to open
/etc/samba/secrets.tdb
Jan 10 16:18:00 myhost winbindd[4490]: [2008/01/10 16:18:00, 0]
nsswitch/winbindd.c:main(1010)
Jan 10 16:18:00 myhost winbindd[4490]:   Could not initialize domain trust
account secrets. Giving up

Clearly winbind is violating SELinux's targeted policy by trying to write
the secrets.tdb file on /etc/samba directory. I looked at smb.conf's man
page that I could set the directory of this file using the "private dir"
directive on smb.conf's global section, and that's what I did, I set it to
/var/cache/samba/winbindd_privileged, which I found was a directory created
by the samba-common package, with 750 permissions and a winbind_var_run_t
context.

I would like to know if I did the right thing or not. Or if I should have
put the secrets.tdb in a directory other than that one. What would be the
recommended configuration?

Thanks!
Filipe
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.centos.org/pipermail/centos/attachments/20080110/9e84522b/attachment-0004.html>